‘SMEs raising employee awareness of cyberthreats is crucial’

Belgium generally performs well in terms of cybersecurity, but according to Phédra Clouner, SMEs are lagging behind. “Cybersecurity and ICT are not part of their core business,” she says. “Moreover, it takes financial resources and employees to ensure a proper level of cybersecurity, and SMEs often don’t have an IT manager or Chief Security Officer.”

The biggest problem? Many SMEs don’t realise they can be targeted by cybercriminals. “But they can! Cybercriminals know that smaller companies are often less well protected. In addition, they are seen as a weak link in the supply chain because they provide goods or services to larger companies.” The rise of cloud computing also poses specific risks.

NIS2 Directive also in play

What can SMEs do to strengthen their cybersecurity? According to Clouner, there are some simple and affordable solutions. “The most important thing is raising employee awareness. Phishing, in the broad sense of the word, is at the root of 80% of cyberattacks. They can happen by email but also through smishing – text message fraud – or vishing – voice scams by phone.”

Raising awareness can be done through training programmes such as Orange Belgium’s Managed Security Awareness Programme. Their importance goes well beyond protection against attacks. After all, there are also legal obligations. In October 2024, the European NIS2 Directive came into force in Belgium. “Europe takes cybersecurity very seriously, both on a European level and within each member state. We all know that cyberthreats don’t stop at national borders.”

This has concrete implications for Belgian SMEs. “Companies need to secure their production chain and that includes SMEs. Officially, the NIS2 Directive applies only to medium and large companies. However, to be NIS2-compliant themselves, goods and services providers are also demanding certain security measures from SMEs, such as ISO 27001 certification or the CyberFundamentals Framework.”

AI and cyberattacks

Should we be worried about the impact of artificial intelligence on cyberattacks? According to Clouner, there’s no reason to panic. “Yes, AI can make phishing emails more credible and help to develop malware or crack passwords more easily. But AI is not only used by ‘the bad guys’. It’s also a useful tool in the fight against cybercriminals. For example, it can help to detect anomalies faster, flag suspicious behaviour on networks, identify malware and automate certain aspects of incident response – always with human verification, of course.”

In collaboration with: